Buggy code:
public class ComponentTag extends MarkupElement { public static final String DEFAULT_WICKET_NAMESPACE = MarkupParser . WICKET ; private ComponentTag closes ; protected final XmlTag xmlTag ; private boolean autolink = false ; private String id ; private boolean modified = false ; private boolean ignore = false ; private boolean autoComponent = false ; private WeakReference < Class < ? extends Component > > markupClassRef = null ; private boolean hasNoCloseTag = false ; private List < Behavior > behaviors ; private Map < String , Object > userData ; public ComponentTag ( final String name , final XmlTag . TagType type ) { } public ComponentTag ( final XmlTag tag ) { } public ComponentTag ( final ComponentTag tag ) { } public final void addBehavior ( final Behavior behavior ) { } public final boolean hasBehaviors ( ) { } public final Iterator < ? extends Behavior > getBehaviors ( ) { } @ Override public final boolean closes ( final MarkupElement open ) { } public final void enableAutolink ( final boolean autolink ) { } public final IValueMap getAttributes ( ) { } public final String getAttribute ( String name ) { } public final String getId ( ) { } public final int getLength ( ) { } public final String getName ( ) { } public final boolean getNameChanged ( ) { } public final String getNamespace ( ) { } public final ComponentTag getOpenTag ( ) { } public final int getPos ( ) { } public final CharSequence getString ( String key ) { } public final TagType getType ( ) { } public final boolean isAutolinkEnabled ( ) { } public final boolean isClose ( ) { } public final boolean isOpen ( ) { } public final boolean isOpen ( String id ) { } public final boolean isOpenClose ( ) { } public final boolean isOpenClose ( String id ) { } public boolean hasEqualTagName ( final ComponentTag tag ) { } public final void makeImmutable ( ) { } public ComponentTag mutable ( ) { } void copyPropertiesTo ( final ComponentTag dest ) { } public final void put ( final String key , final boolean value ) { } public final void put ( final String key , final int value ) { } public final void put ( String key , CharSequence value ) { } public final void append ( String key , CharSequence value , String separator ) { } public final void put ( String key , StringValue value ) { } public final void putAll ( final Map < String , Object > map ) { } public final void remove ( String key ) { } public final boolean requiresCloseTag ( ) { } public final void setId ( final String id ) { } public final void setName ( String name ) { } public final void setNamespace ( String namespace ) { } public final void setOpenTag ( final ComponentTag tag ) { } public final void setType ( final TagType type ) { } public final CharSequence syntheticCloseTagString ( ) { } @ Override public CharSequence toCharSequence ( ) { } @ Override public final String toString ( ) { } public final void writeOutput ( final Response response , final boolean stripWicketAttributes , final String namespace ) { response . write ( "<" ) ; if ( ( getType ( ) ) == ( TagType . CLOSE ) ) { response . write ( "//" ) ; } if ( ( getNamespace ( ) ) != null ) { response . write ( getNamespace ( ) ) ; response . write ( ":" ) ; } response . write ( getName ( ) ) ; String namespacePrefix = null ; if ( stripWicketAttributes == true ) { namespacePrefix = namespace + ":" ; } if ( ( getAttributes ( ) . size ( ) ) > 0 ) { for ( String key : getAttributes ( ) . keySet ( ) ) { if ( key == null ) { continue ; } if ( ( namespacePrefix == null ) || ( ( key . startsWith ( namespacePrefix ) ) == false ) ) { response . write ( "<seq2seq4repair_space>" ) ; response . write ( key ) ; CharSequence value = getString ( key ) ; if ( value != null ) { response . write ( "=\"" ) ; <START_BUG> value = Strings . replaceAll ( value , "\"" , "&#34;" ) ; <END_BUG> response . write ( value ) ; response . write ( "\"" ) ; } } } } if ( ( getType ( ) ) == ( TagType . OPEN_CLOSE ) ) { response . write ( "//" ) ; } response . write ( ">" ) ; } @ Override public final String toUserDebugString ( ) { } final XmlTag getXmlTag ( ) { } public final void setModified ( final boolean modified ) { } final boolean isModified ( ) { } public boolean hasNoCloseTag ( ) { } public void setHasNoCloseTag ( boolean hasNoCloseTag ) { } public Class < ? extends Component > getMarkupClass ( ) { } public < C extends Component > void setMarkupClass ( Class < C > wicketHeaderClass ) { } @ Override public boolean equalTo ( final MarkupElement element ) { } public boolean isIgnore ( ) { } public void setIgnore ( boolean ignore ) { } public boolean isAutoComponentTag ( ) { } public void setAutoComponentTag ( boolean auto ) { } public Object getUserData ( final String key ) { } public void setUserData ( final String key , final Object value ) { } public void onBeforeRender ( final Component component , final MarkupStream markupStream ) { } }

Fix:
value = Strings . escapeMarkup ( value ) ;